CVE-2025-10035

Summary

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.

Affected Software

Weaknesses

• CWE-77: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
• CWE-502: CWE-502 Deserialization of Untrusted Data

Workarounds

Immediately ensure that access to the GoAnywhere Admin Console is not open to the public. Exploitation of this vulnerability is highly dependent upon systems being externally exposed to the internet.

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: active
  • Automatable: yes
  • Technical Impact: total

Additional References

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-10035

References

• https://www.fortra.com/security/advisories/product-security/fi-2025-012

• ←Previous
• Next→